WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
bookingpress-appointment-booking
Published
2025-01-24
Title
BookingPress < 1.1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
bookingpress-appointment-booking
Published
2025-04-01
Title
BookingPress < 1.1.38 - Authenticated (Administrator+) SQL Injection
Slug
bookingpress-appointment-booking
Published
2026-06-17
Title
BookingPress < 1.5.6 - Unauthenticated PHP Object Injection
Slug
bookingpress-appointment-booking
Published
2026-08-27
Title
BookingPress 1.5.6 - 1.6.2 - Unauthenticated Booking Price Manipulation via PayPal Payment Confirmation
Slug
bookingpress-appointment-booking-pro
Published
2026-05-21
Title
BookingPress Pro < 5.7 - Unauthenticated Arbitrary File Upload via Signature Custom Field
Slug
bookingpress-appointment-booking-pro
Published
2026-06-30
Title
BookingPress Appointment Booking Pro < 5.7.2 - Unauthenticated SQL Injection via 'store_service_date' Parameter
Slug
bookingpress-appointment-booking-pro
Published
2026-07-06
Title
BookingPress Pro < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback Bug
Slug
bookingpress-appointment-booking-pro
Published
2026-08-20
Title
BookingPress Appointment Booking Pro < 6.1 - Unauthenticated SQL Injection
Slug
bookings
Published
2014-08-01
Title
Bookings <= 1.8.2 - controlpanel.php error Parameter XSS
Slug
bookit
Published
2021-06-30
Title
Booking Calendar | Appointment Booking | BookIt < 2.1.6 - Authorised AJAX Calls
Slug
bookit
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
bookit
Published
2023-06-20
Title
BookIt < 2.3.8 - Authentication Bypass
Slug
bookit
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
bookit
Published
2023-12-21
Title
BookIt < 2.4.4 - Authenticated(Administrator+) SQL Injection
Slug
bookit
Published
2024-01-31
Title
BookIt <= 2.4.0 - Price Bypass
Slug
bookit
Published
2025-11-15
Title
Bookit < 2.5.1 – Unauthenticated Settings Update
Slug
bookit
Published
2025-11-11
Title
Booking Calendar | Appointment Booking | Bookit < 2.5.1 - Missing Authorization to Unauthenticated Stripe Connection
Slug
bookit
Published
2026-04-22
Title
Bookit — Booking & Appointment Calendar < 2.5.4.1 - Missing Authorization
Slug
bookit
Published
2026-09-03
Title
Bookit — Booking & Appointment Calendar < 2.6.0.4 - Missing Authorization
Slug
bookly-responsive-appointment-booking-tool
Published
2018-02-10
Title
Bookly #1 WordPress Booking Plugin (Lite) < 14.5 – Unauthenticated Blind Stored XSS
Slug
bookly-responsive-appointment-booking-tool
Published
2021-11-08
Title
Bookly < 20.3.1 - Staff Member Stored Cross-Site Scripting
Slug
bookly-responsive-appointment-booking-tool
Published
2023-03-17
Title
Bookly < 21.6 - Unauthenticated Stored XSS
Slug
bookly-responsive-appointment-booking-tool
Published
2023-06-01
Title
Bookly < 21.8 - Admin+ Stored Cross-Site Scripting via service titles
Slug
bookly-responsive-appointment-booking-tool
Published
2023-09-25
Title
Bookly < 22.4 - Admin+ SQLi
Slug
bookly-responsive-appointment-booking-tool
Published
2023-11-06
Title
Bookly < 22.5 - Admin+ Stored XSS